davidjb
commented
8 years ago Firstly, if you've made changes to your Shibboleth configuration files, make sure all your services have been restarted -- and ensure that whenever you restart shibd and the shibauthorizer and shibresponder (in that order). I've been left confused a few times by only restarting part of the stack.
Assuming all the parts have the correct config present, then it looks like all of the Shibboleth headers are making it through to your PHP application (eg HTTPSHIB* headers and HTTP_MAIL). I'd firstly suggest checking your attribute-map.xml file for Shibboleth to ensure that the mail attribute is listed and/or uncommented and its ID is correct. I would assume it is, given the presence of HTTP_MAIL, but it's worth checking.
Next, you can check whether your Shibauthorizer is yielding the correct REMOTE_USER header (seen as Variable-REMOTE_USER from a FastCGI authorizer) like so:
location /secure {
...
shib_request_set $shib_remote_user $upstream_http_variable_remote_user;
proxy_set_header X-TEST $shib_remote_user;
proxy_pass http://[ip]:8081;
}This loads the upstream variable from the shibauthorizer response into an Nginx variable in this scope, and then sets that variable to be the header X-TEST before being sent to your backend Apache instance. If you see X-TEST with your expected REMOTE_USER attribute, then this proves that Apache is the issue. If you don't, then check your Shibboleth configuration as there might be something else (perhaps in shibboleth2.xml) that's overriding your REMOTE_USER config. At a hunch though, I suspect Apache or its modules are getting in the way here and either overriding or dropping the REMOTE_USER header.
In either case, you'd be best to consider running PHP under FastCGI so Nginx can talk to it directly (see http://php-fpm.org/ and various tutorials at https://www.nginx.com/resources/wiki/start/). That avoids the extra translation step to Apache, simplifies your stack, reduces memory usage and will speed up your application considerably. You can also gain the benefit of being able to avoid the use of headers (see https://github.com/nginx-shib/nginx-http-shibboleth/tree/development) -- as you can pass environment variables to the PHP FastCGI process through Nginx's configuration.
Debugging this kind of stack is very hard as Shibboleth's FastCGI apps don't log anything irrespective of logging settings, so if you get stuck, try and switch to running PHP under FastCGI and simplify things. If you're still stuck at this point, create a super-simple HTTP proxy (I'd suggest Bottle for Python) and use that as your backend proxy_pass application -- and print out the request headers.
alex-dot
I am trying to configure shibboleth through nginx but am currently stuck at not getting the Remote-User variable displayed. I am currently releasing two attributes one of which is mail which I have defined to be assigned as REMOTE_USER:
But when checking on the shibboleth-secured site, I do not see the variable. This is all I get:
Note that I proxy_pass to Apache so it can compile the PHP. Could that be the problem? On plain Apache (with mod_shib) the variable is set correctly. Here is my vhost conf: